Examkin

Question

Difficulty: HardAccount Statements, Privacy Protection, and Regulation S-P

A broker-dealer compliance department is conducting a regulatory audit of its data protection policies under SEC Regulation S-P and statement disclosure procedures under FINRA rules. Which of the following statements regarding initial privacy notices, consumer opt-out provisions, and annual delivery exemptions are correct?

  1. A consumer who does not establish an ongoing customer relationship with the broker-dealer must be provided an initial privacy notice before the firm discloses nonpublic personal information to nonaffiliated third parties.Answer
  2. Requiring a customer to write and mail their own custom letter is considered an unreasonable opt-out method under Regulation S-P guidelines.Answer
  3. C
    A broker-dealer must issue an annual privacy notice to all retail customers regardless of whether its privacy policy has changed or if it discloses nonpublic personal information exclusively under statutory exceptions.
  4. D
    Broker-dealers are strictly prohibited from delivering account statements electronically, requiring physical paper mailings for all active retail margin accounts.

Answer

The correct statements are that a consumer without an ongoing customer relationship must receive an initial privacy notice before nonpublic personal information is shared with nonaffiliated third parties, and that requiring customers to write custom letters is an unreasonable opt-out mechanism.
Under SEC Regulation S-P, a consumer (an individual obtaining a financial service on a one-time basis) only needs an initial privacy notice if the firm plans to disclose nonpublic personal information to nonaffiliated third parties. Furthermore, opt-out mechanisms must be reasonable and convenient; requiring a customer to draft a custom letter fails the reasonable opportunity test. Therefore, both the statement on consumer initial notices and the statement on unreasonable opt-out mechanisms are correct.

Step-by-Step Solution

1
Analyze Regulation S-P requirements for 'consumer' versus 'customer' initial disclosures.
Identified that 'consumers' only require an initial privacy notice if nonpublic personal information is shared with nonaffiliated third parties, whereas 'customers' must receive one upon establishing a relationship.
Reg S-P distinguishes between one-off consumers and ongoing customer relationships.
2
Evaluate opt-out mechanism rules under Regulation S-P.
Confirmed that opt-out mechanisms must be convenient (e.g., toll-free number, check-box form, or electronic link). Custom letter drafting imposes undue burden.
Financial institutions cannot create unreasonable friction for clients exercising privacy rights.
3
Assess annual privacy notice exemptions and statement delivery rules.
Recognized that the FAST Act exempts BDs from annual privacy notice deliveries if sharing is restricted to statutory exceptions and policies remain unchanged, and noted that electronic statement delivery is allowed with client consent.
Regulatory relief updates permit streamlined notice delivery, and electronic delivery satisfies FINRA/SEC delivery obligations.

Key Concept

Regulation S-P Privacy Notice Delivery and Opt-Out Requirements
Rate this question

Topics

Account Statements, Privacy Protection, and Regulation S-P